Is a VLAN a security boundary?

Only when traffic between VLANs passes through a firewall or access rules that enforce something. A VLAN by itself separates broadcast domains on a switch; if the router between VLANs allows everything, the separation is cosmetic, and that is a common finding in small networks. Misconfigured switch ports can also let an attacker hop between VLANs, for example trunk ports left open to user devices, or the default VLAN used for everything. To make VLANs count: route between them through a firewall with an allow list, set user ports to a single access VLAN, disable unused ports, and keep management interfaces in their own VLAN. Then check that the rules hold with real traffic. NetSenX shows host-to-host connections on monitored segments and flags scanning and lateral movement on every plan, so a host that reaches across VLANs where it should not becomes visible, as long as that traffic crosses a mirrored link.

← All 45 questions on Zero trust, identity and segmentationAll topics